Vulnerabilities

TI-2026-01677 CVE-2026-2020 · GHSA-7j7c-35qg-3347

JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute

LOW 35

The JS Archive List plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.1.7 via the 'included' shortcode attribute.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0049 Published 2026-03-07 No fix listed CWE-502

TI-2025-07002 CVE-2025-7670 · GHSA-mp34-36vv-8364

JS Archive List <= 6.1.5 - Unauthenticated SQL Injection via build_sql_where Function

LOW 39

The JS Archive List plugin for WordPress is vulnerable to time-based SQL Injection via the build_sql_where() function in all versions up to, and including, 6.1.5 due to insufficient escaping on the user supplied paramete…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00519 Published 2025-08-19 No fix listed CWE-89

Vulnerabilities

Filters

JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute

JS Archive List <= 6.1.5 - Unauthenticated SQL Injection via build_sql_where Function